Closed keny2021 closed 3 years ago
I don't think there is a "simple_query_string". Isn't it a mistake of "query_string"? Where were you on?
I have tried "query_string" as well - not even 1 hit.
"Simple_query_string" comes from here: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html
There is no such thing as simple_query_string
I don't think elastalert supports it.
elastalert is not maintained
alert:
- "slack"
alert_subject: "Test {0} 123 {1} aa"
alert_subject_args:
- "message"
- "@timestamp"
alert_text: "Test {0} 123 {1} bb"
alert_text_args:
- "message"
- "@timestamp"
filter:
- query:
query_string:
query: "message:Quit"
generate_kibana_discover_url: true
import: "BaseRule.config"
index: "mariadblog-*"
is_enabled: true
name: "a"
num_events: 1
realert:
minutes: 5
slack_channel_override: "#abc"
slack_emoji_override: ":ghost:"
slack_ignore_ssl_errors: false
slack_msg_color: "danger"
slack_parse_override: "none"
slack_timeout: 10
slack_title_link: "http://127.0.0.1:8080/rules/a"
slack_webhook_url: "https://hooks.slack.com/services/**********"
slack_username_override: "elastalert"
terms_size: 50
timeframe:
minutes: 5
timestamp_field: "@timestamp"
timestamp_type: "iso"
type: "frequency"
use_strftime_index: false
@keny2021
Read the elasticsearch docs, not the elasticsearch docs https://elastalert.readthedocs.io/en/latest/ https://github.com/Yelp/elastalert/blob/master/README.md
I won't answer the question anymore. Do something about yourself.
@nsano-rururu
Thank you for your replies. One last question, what is the content of your "BaseRule.config" file?
@keny2021
It is a configuration file of praeco of the web application that generates yaml from the screen with the rules of elastalert. Write settings that cannot be set on the screen in BaseRule.config. In this case slack webhook_url.
By the way, I'm the maintainer of praco. https://github.com/johnsusek/praeco
@nsano-rururu that's interesting. Congrats on the Praeco app.
However I am still having issues with my query.
@rehannali How did you fix the issue 2754? what credentials have you used?
@rpotnuru , thanks for helping me out. Problem with credentials thats why it was unable to read index.
Originally posted by @rehannali in https://github.com/Yelp/elastalert/issues/2754#issuecomment-619937538
@keny2021
Is that so. Please do your best.
@keny2021 You can use admin or root user password for it to work. I wouldn't recommend you to do it. So, you need to create special user and assign specific index and use that for connectivity.
@rehannali Thanks for the quick response.
Could you please include the last version of the full code of your rule? Many thanks again
@keny2021 code is like my issue you mentioned earlier. I only changed es_username
and es_password
with newly created user and password.
@rehannali how did you create new user in elasticsearch?
@keny2021 Did you enable security module in elastic search?
@rehannali no it's not enabled. I need that to create new users, right?
yes
If it is resolved, please close it
This has been resolved. Timestamp was the culprit.
Hi guys, I'm trying to create a rule in elastalert with a simple query and nothing seems to work. I have a created a new index in kibana and every 5 minutes it creates this output when a machine is at 100% CPU: `
` I've tried multiple rules search queries and this is my last version, trying to set up an alert for each of the above outputs, using the term "ALERT":
When I run the rule all I get is this:
Slack alert is working properly, I have tested it.
Any thoughts? Many thanks